BSOD while idle only happening after fresh install.

Xemidra · 20 Jan 2018

Hi,

I noticed that a day after a fresh reinstall of Windows 7 on my computer I get a BSOD. I don't have any idea what's causing it. It seems to only happen once after the reinstall. I didn't observe it to happen again. Can you help me find out why this is happening to me?

Best regards.

Code:

Microsoft (R) Windows Debugger Version 6.3.9600.17336 AMD64
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [C:\Windows\Minidump\012018-16208-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available


************* Symbol Path validation summary **************
Response                         Time (ms)     Location
Deferred                                       SRV*C:\SymCache*http://msdl.microsoft.com/download/symbols
Symbol search path is: SRV*C:\SymCache*http://msdl.microsoft.com/download/symbols
Executable search path is: 
Windows 7 Kernel Version 7601 (Service Pack 1) MP (4 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 7601.23915.amd64fre.win7sp1_ldr.170913-0600
Machine Name:
Kernel base = 0xfffff800`02c17000 PsLoadedModuleList = 0xfffff800`02e59750
Debug session time: Sat Jan 20 03:22:05.672 2018 (UTC + 1:00)
System Uptime: 0 days 7:18:50.233
Loading Kernel Symbols
.

Press ctrl-c (cdb, kd, ntsd) or ctrl-break (windbg) to abort symbol loads that take too long.
Run !sym noisy before .reload to track down problems loading symbols.

..............................................................
................................................................
...........................................
Loading User Symbols
Loading unloaded module list
...............
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck A, {fffff8a016e0d2f0, 2, 1, fffff80002c657de}

Probably caused by : ntkrnlmp.exe ( nt!ExDeleteResourceLite+ce )

Followup: MachineOwner
---------

3: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

IRQL_NOT_LESS_OR_EQUAL (a)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high.  This is usually
caused by drivers using improper addresses.
If a kernel debugger is available get the stack backtrace.
Arguments:
Arg1: fffff8a016e0d2f0, memory referenced
Arg2: 0000000000000002, IRQL
Arg3: 0000000000000001, bitfield :
	bit 0 : value 0 = read operation, 1 = write operation
	bit 3 : value 0 = not an execute operation, 1 = execute operation (only on chips which support this level of status)
Arg4: fffff80002c657de, address which referenced memory

Debugging Details:
------------------


WRITE_ADDRESS: GetPointerFromAddress: unable to read from fffff80002ec3100
GetUlongFromAddress: unable to read from fffff80002ec31c8
 fffff8a016e0d2f0 Paged pool

CURRENT_IRQL:  2

FAULTING_IP: 
nt!ExDeleteResourceLite+ce
fffff800`02c657de 488908          mov     qword ptr [rax],rcx

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  WIN7_DRIVER_FAULT

BUGCHECK_STR:  0xA

PROCESS_NAME:  svchost.exe

ANALYSIS_VERSION: 6.3.9600.17336 (debuggers(dbg).150226-1500) amd64fre

TRAP_FRAME:  fffff88008b43a00 -- (.trap 0xfffff88008b43a00)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=fffff8a016e0d2f0 rbx=0000000000000000 rcx=fffffa801d8f8f50
rdx=000000000000070d rsi=0000000000000000 rdi=0000000000000000
rip=fffff80002c657de rsp=fffff88008b43b90 rbp=fffffa8028345010
 r8=fffff88008b43ca1  r9=fffff8a01af02ed0 r10=fffff88002fd69c0
r11=0000000000000000 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0         nv up ei pl zr na po nc
nt!ExDeleteResourceLite+0xce:
fffff800`02c657de 488908          mov     qword ptr [rax],rcx ds:fffff8a0`16e0d2f0=fffffa8025fc1640
Resetting default scope

LAST_CONTROL_TRANSFER:  from fffff80002c873a9 to fffff80002c87e00

STACK_TEXT:  
fffff880`08b438b8 fffff800`02c873a9 : 00000000`0000000a fffff8a0`16e0d2f0 00000000`00000002 00000000`00000001 : nt!KeBugCheckEx
fffff880`08b438c0 fffff800`02c86020 : fffff8a0`1af02a90 fffffa80`28345010 fffff880`08b43b18 fffffa80`25fc1640 : nt!KiBugCheckDispatch+0x69
fffff880`08b43a00 fffff800`02c657de : fffff8a0`1af02ed0 fffff880`012aba5d 00000000`c0000035 fffffa80`28345010 : nt!KiPageFault+0x260
fffff880`08b43b90 fffff880`0122b873 : fffffa80`25fc1600 fffffa80`28345010 fffffa80`25fc1600 fffffa80`0a46f180 : nt!ExDeleteResourceLite+0xce
fffff880`08b43bf0 fffff880`012b4092 : fffff880`08b43cb0 00000000`00000745 fffffa80`25fc1600 fffffa80`159b5be0 : Ntfs!NtfsFreeNonpagedIndexFcb+0x13
fffff880`08b43c20 fffff880`012302a2 : fffffa80`28345010 fffff880`08b43e01 fffff880`08b43ca1 fffff8a0`1af02a90 : Ntfs!NtfsDeleteFcb+0x3e2
fffff880`08b43c80 fffff880`012b5b4c : fffffa80`159b5be0 fffffa80`0a46f180 fffff8a0`1af02a90 fffff8a0`1af02ed0 : Ntfs!NtfsTeardownFromLcb+0x1e2
fffff880`08b43d10 fffff880`012cf481 : fffffa80`159b5be0 00000000`c0000035 fffff8a0`01432ed0 fffff880`08a25300 : Ntfs!NtfsTeardownStructures+0xcc
fffff880`08b43d90 fffff880`012384cd : fffffa80`159b5be0 fffffa80`28345010 fffff880`08a25380 fffffa80`293db000 : Ntfs!NtfsCommonCreate+0x1b83
fffff880`08b43f30 fffff800`02c7f8f7 : fffff880`08a252f0 00000000`00000000 00000000`00000000 00000000`00000000 : Ntfs!NtfsCommonCreateCallout+0x1d
fffff880`08b43f60 fffff800`02c7f8b8 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KxSwitchKernelStackCallout+0x27
fffff880`08a251c0 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSwitchKernelStackContinue


STACK_COMMAND:  kb

FOLLOWUP_IP: 
nt!ExDeleteResourceLite+ce
fffff800`02c657de 488908          mov     qword ptr [rax],rcx

SYMBOL_STACK_INDEX:  3

SYMBOL_NAME:  nt!ExDeleteResourceLite+ce

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: nt

IMAGE_NAME:  ntkrnlmp.exe

DEBUG_FLR_IMAGE_TIMESTAMP:  59b946d1

IMAGE_VERSION:  6.1.7601.23915

FAILURE_BUCKET_ID:  X64_0xA_nt!ExDeleteResourceLite+ce

BUCKET_ID:  X64_0xA_nt!ExDeleteResourceLite+ce

ANALYSIS_SOURCE:  KM

FAILURE_ID_HASH_STRING:  km:x64_0xa_nt!exdeleteresourcelite+ce

FAILURE_ID_HASH:  {6a76bd36-cc4b-23b8-9ecd-2a72bfc05073}

Followup: MachineOwner
---------

Code:

Microsoft (R) Windows Debugger Version 6.3.9600.17336 AMD64
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [C:\Windows\MEMORY.DMP]
Kernel Summary Dump File: Only kernel address space is available


************* Symbol Path validation summary **************
Response                         Time (ms)     Location
Deferred                                       SRV*C:\SymCache*http://msdl.microsoft.com/download/symbols
Symbol search path is: SRV*C:\SymCache*http://msdl.microsoft.com/download/symbols
Executable search path is: 
Windows 7 Kernel Version 7601 (Service Pack 1) MP (4 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 7601.23915.amd64fre.win7sp1_ldr.170913-0600
Machine Name:
Kernel base = 0xfffff800`02c17000 PsLoadedModuleList = 0xfffff800`02e59750
Debug session time: Sat Jan 20 03:22:05.672 2018 (UTC + 1:00)
System Uptime: 0 days 7:18:50.233
Loading Kernel Symbols
...............................................................
................................................................
...........................................
Loading User Symbols
PEB is paged out (Peb.Ldr = 000007ff`fffd3018).  Type ".hh dbgerr001" for details
Loading unloaded module list
...............
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck A, {fffff8a016e0d2f0, 2, 1, fffff80002c657de}

Probably caused by : ntkrnlmp.exe ( nt!ExDeleteResourceLite+ce )

Followup: MachineOwner
---------

3: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

IRQL_NOT_LESS_OR_EQUAL (a)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high.  This is usually
caused by drivers using improper addresses.
If a kernel debugger is available get the stack backtrace.
Arguments:
Arg1: fffff8a016e0d2f0, memory referenced
Arg2: 0000000000000002, IRQL
Arg3: 0000000000000001, bitfield :
	bit 0 : value 0 = read operation, 1 = write operation
	bit 3 : value 0 = not an execute operation, 1 = execute operation (only on chips which support this level of status)
Arg4: fffff80002c657de, address which referenced memory

Debugging Details:
------------------


WRITE_ADDRESS:  fffff8a016e0d2f0 Paged pool

CURRENT_IRQL:  2

FAULTING_IP: 
nt!ExDeleteResourceLite+ce
fffff800`02c657de 488908          mov     qword ptr [rax],rcx

DEFAULT_BUCKET_ID:  WIN7_DRIVER_FAULT

BUGCHECK_STR:  0xA

PROCESS_NAME:  svchost.exe

ANALYSIS_VERSION: 6.3.9600.17336 (debuggers(dbg).150226-1500) amd64fre

TRAP_FRAME:  fffff88008b43a00 -- (.trap 0xfffff88008b43a00)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=fffff8a016e0d2f0 rbx=0000000000000000 rcx=fffffa801d8f8f50
rdx=000000000000070d rsi=0000000000000000 rdi=0000000000000000
rip=fffff80002c657de rsp=fffff88008b43b90 rbp=fffffa8028345010
 r8=fffff88008b43ca1  r9=fffff8a01af02ed0 r10=fffff88002fd69c0
r11=0000000000000000 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0         nv up ei pl zr na po nc
nt!ExDeleteResourceLite+0xce:
fffff800`02c657de 488908          mov     qword ptr [rax],rcx ds:fffff8a0`16e0d2f0=fffffa8025fc1640
Resetting default scope

LAST_CONTROL_TRANSFER:  from fffff80002c873a9 to fffff80002c87e00

STACK_TEXT:  
fffff880`08b438b8 fffff800`02c873a9 : 00000000`0000000a fffff8a0`16e0d2f0 00000000`00000002 00000000`00000001 : nt!KeBugCheckEx
fffff880`08b438c0 fffff800`02c86020 : fffff8a0`1af02a90 fffffa80`28345010 fffff880`08b43b18 fffffa80`25fc1640 : nt!KiBugCheckDispatch+0x69
fffff880`08b43a00 fffff800`02c657de : fffff8a0`1af02ed0 fffff880`012aba5d 00000000`c0000035 fffffa80`28345010 : nt!KiPageFault+0x260
fffff880`08b43b90 fffff880`0122b873 : fffffa80`25fc1600 fffffa80`28345010 fffffa80`25fc1600 fffffa80`0a46f180 : nt!ExDeleteResourceLite+0xce
fffff880`08b43bf0 fffff880`012b4092 : fffff880`08b43cb0 00000000`00000745 fffffa80`25fc1600 fffffa80`159b5be0 : Ntfs!NtfsFreeNonpagedIndexFcb+0x13
fffff880`08b43c20 fffff880`012302a2 : fffffa80`28345010 fffff880`08b43e01 fffff880`08b43ca1 fffff8a0`1af02a90 : Ntfs!NtfsDeleteFcb+0x3e2
fffff880`08b43c80 fffff880`012b5b4c : fffffa80`159b5be0 fffffa80`0a46f180 fffff8a0`1af02a90 fffff8a0`1af02ed0 : Ntfs!NtfsTeardownFromLcb+0x1e2
fffff880`08b43d10 fffff880`012cf481 : fffffa80`159b5be0 00000000`c0000035 fffff8a0`01432ed0 fffff880`08a25300 : Ntfs!NtfsTeardownStructures+0xcc
fffff880`08b43d90 fffff880`012384cd : fffffa80`159b5be0 fffffa80`28345010 fffff880`08a25380 fffffa80`293db000 : Ntfs!NtfsCommonCreate+0x1b83
fffff880`08b43f30 fffff800`02c7f8f7 : fffff880`08a252f0 00000000`00000000 00000000`00000000 00000000`00000000 : Ntfs!NtfsCommonCreateCallout+0x1d
fffff880`08b43f60 fffff800`02c7f8b8 : 00000000`00000000 00000000`00000000 fffff880`08b44000 fffff800`02c948c2 : nt!KxSwitchKernelStackCallout+0x27
fffff880`08a251c0 fffff800`02c948c2 : 00000000`00000000 00000000`00000002 00000000`00000000 00000000`00000000 : nt!KiSwitchKernelStackContinue
fffff880`08a251e0 fffff880`01238c4f : fffff880`012384b0 fffff880`01237a80 fffffa80`2a372b00 fffff880`012d7b00 : nt!KeExpandKernelStackAndCalloutEx+0x2a2
fffff880`08a252c0 fffff880`012d057c : 00000000`00000000 00000000`00000000 fffff880`08a25520 fffffa80`28345010 : Ntfs!NtfsCommonCreateOnNewStack+0x4f
fffff880`08a25320 fffff880`0114abcf : fffffa80`0a46f030 fffffa80`28345010 0000fa00`00000000 fffff880`08a256e0 : Ntfs!NtfsFsdCreate+0x1ac
fffff880`08a254d0 fffff880`0116a2b9 : fffffa80`28345010 fffffa80`0a46e010 fffffa80`28345000 fffffa80`0a3c08e0 : fltmgr!FltpLegacyProcessingAfterPreCallbacksCompleted+0x24f
fffff880`08a25560 fffff880`0114abcf : 00000000`00000000 fffffa80`09c637b0 00000000`00000000 00000000`00000000 : fltmgr!FltpCreate+0x2a9
fffff880`08a25610 fffff880`0116a2b9 : fffffa80`28345010 fffffa80`0ecec010 fffffa80`28345000 fffffa80`0ece8de0 : fltmgr!FltpLegacyProcessingAfterPreCallbacksCompleted+0x24f
fffff880`08a256a0 fffff800`02f8d2bb : 00000000`00000005 00000000`00000040 fffffa80`293dea90 00000000`00000000 : fltmgr!FltpCreate+0x2a9
fffff880`08a25750 fffff800`02f88dde : fffffa80`0a355cd0 00000000`00000000 fffffa80`28302b10 fffff880`08a25901 : nt!IopParseDevice+0x14e2
fffff880`08a258b0 fffff800`02f898c6 : 00000000`00000000 fffff880`08a25a30 fffff880`00000040 fffffa80`09c637b0 : nt!ObpLookupObjectName+0x784
fffff880`08a259b0 fffff800`02f8b6bc : 00000000`00000000 00000000`00000000 00000000`00000001 00000000`00000000 : nt!ObOpenObjectByName+0x306
fffff880`08a25a80 fffff800`02f96d34 : 00000000`010bead0 00000000`00100001 00000000`010bea80 00000000`010bea50 : nt!IopCreateFile+0x2bc
fffff880`08a25b20 fffff800`02c87093 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!NtCreateFile+0x78
fffff880`08a25bb0 00000000`76d5c28a : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x13
00000000`010be9d8 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x76d5c28a


STACK_COMMAND:  kb

FOLLOWUP_IP: 
nt!ExDeleteResourceLite+ce
fffff800`02c657de 488908          mov     qword ptr [rax],rcx

SYMBOL_STACK_INDEX:  3

SYMBOL_NAME:  nt!ExDeleteResourceLite+ce

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: nt

IMAGE_NAME:  ntkrnlmp.exe

DEBUG_FLR_IMAGE_TIMESTAMP:  59b946d1

IMAGE_VERSION:  6.1.7601.23915

FAILURE_BUCKET_ID:  X64_0xA_nt!ExDeleteResourceLite+ce

BUCKET_ID:  X64_0xA_nt!ExDeleteResourceLite+ce

ANALYSIS_SOURCE:  KM

FAILURE_ID_HASH_STRING:  km:x64_0xa_nt!exdeleteresourcelite+ce

FAILURE_ID_HASH:  {6a76bd36-cc4b-23b8-9ecd-2a72bfc05073}

Followup: MachineOwner
---------

Xemidra · 20 Jan 2018

Below you will find logs from dm log collector.

**axe0** · 24 Jan 2018

Diagnostics Test

HDD TEST

Note

Please run HDTune first, in the order posted!

Run HDTune to

check the health,
scan for errors, no quick scan but full scan
run a benchmark.

It may take some time, but please take the time you need to perform it properly.
When above is done please make screenshots of the following

the health,
the error scan,
the benchmark incl. following
- transfer rate,
- access time,
- burst rate,
- cpu usage.

Run SeaTools DOS to check the integrity of your HDD. SeaTools for DOS and Windows - How to Use - Windows 7 Help Forums
Run the long test.

Note

Do not run SeaTools on an SSD as the results will be invalid.

Make a photo of the result and post it.

Run chkdsk
Disk Check - Windows 7 Help Forums
Use option TWO with parameter /r
Upload the chkdsk log

Check Disk (chkdsk) - Read Event Viewer Log - Windows 7 Help Forums

Xemidra · 28 Jan 2018

When the first BSOD appeared I only had one HDD. It was later replaced with SSD and new bigger HDD for storage. I don't think it's drive related. Like I said. I didn't observe any more BSOD error since the first one.

**axe0** · 29 Jan 2018

I still would like to know the results.